Privacy policy
Last updated: October 15, 2026
This policy explains how Mailnitrix ("Mailnitrix", "we") handles personal data when you visit our website or use the Mailnitrix application (the "Service").
Two roles
- For your account, we are the controller: we decide how your account and billing data is used.
- For the contacts you upload and the emails you send, you are the controller and we are your processor. We use that data only to provide the Service to you, under your instructions.
What we collect
Account data. Your name and email address. You sign in with Google or Microsoft, which tell us your name, email address and an account ID; we never see your Google or Microsoft password. (Accounts created before sign-up opened may also have a username and a hashed password.) If you buy a paid plan, our payment provider processes your payment details; we receive only what we need for billing, such as your plan and invoice history.
Sign-in and security data. When you sign up or sign in, we record the time, your IP address, your browser's user agent and a random device identifier, to keep your account secure and to limit how many free accounts can be created from one network or browser.
Mailbox connections. The addresses and server settings of the mailboxes you connect. Gmail app passwords and Microsoft sign-in tokens are encrypted before they are stored.
Contacts and content. The contact lists you upload (for example email addresses, names and any other columns you include), your templates, campaigns and the record of what was sent. Uploaded files themselves are read in memory and not stored.
Open and click tracking data. When tracking is on for a campaign, each email contains a small image. When it loads, we record the time, IP address and browser information of the request, so we can mark the email as opened and filter out automatic opens by privacy proxies and security scanners. When click tracking is on, links in the email go through our tracking domain first; we record the same details for each click, then forward you to the link.
Unsubscribes and suppression lists. When someone unsubscribes from a customer's emails, or an address turns out not to exist, we keep that address on the customer's suppression list so their campaigns don't email it again.
Warmup data. For mailboxes with warmup switched on, we connect over IMAP to find the warmup emails we sent, note which folder they arrived in, and mark, move, reply to or archive them. We look for warmup emails by their unique message ID; we don't read the rest of your mailbox.
Replies and bounces. For mailboxes that sent campaign emails in the last 60 days, we check the inbox over IMAP every few minutes for replies and delivery-failure notices. We look at the headers of new messages and download only those that answer one of your campaign emails, come from one of your leads, or report a failed delivery. We store those (sender, subject and text) so you can see who replied and why an email bounced. Other messages are never downloaded or stored, and we never mark anything as read.
Cookies. This website does not use advertising or tracking cookies. The application uses strictly necessary cookies only: one keeps you signed in, one identifies your browser for the sign-up limits above, and one protects a sign-in in progress.
How we use it
- To provide, secure and support the Service
- To bill you and keep financial records
- To send service messages, such as security alerts and changes to these policies
- To understand how the Service is used in aggregate, so we can improve it
- To meet legal obligations and enforce our terms
We do not sell personal data, and we don't use your contacts or email content to train models or for any purpose of our own.
Legal bases
Where the GDPR or similar laws apply, we rely on: performing our contract with you; our legitimate interests in running a secure, reliable service; legal obligations; and consent where it is required.
Who we share it with
- Service providers that host and run the Service, process payments or deliver our own service emails, under contracts that protect your data
- Google and Microsoft, when you connect a mailbox and ask us to send, warm up or check replies through it
- Authorities, when the law requires it
International transfers
Our providers may process data in other countries. Where that happens, we use appropriate safeguards such as standard contractual clauses.
How long we keep it
We keep account data while your account is open. When you close it, we delete your data within 30 days, except records we must keep by law (such as invoices). Backups expire on a rolling basis. You can delete contacts, mailboxes and campaigns yourself at any time.
Security
We protect data with encryption in transit and at rest, hashed passwords and limited access. Read more on our security page.
Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, or object to or restrict how we use it. Email legal@mailnitrix.com. You can also complain to your local data protection authority.
If you received an email sent through Mailnitrix, the sender is responsible for it. Please contact them directly. If you can't, email us and we'll pass your request on.
Children
The Service isn't for anyone under 18, and we don't knowingly collect their data.
Changes
We'll post updates here and change the date above. For significant changes, we'll tell account holders by email.